Date:   Tue, 31 Jan 2023 08:51:25 -0800
From:   Ashok Raj <ashok.raj@intel.com>
To:     Borislav Petkov <bp@alien8.de>
CC:     Thomas Gleixner <tglx@linutronix.de>,
        LKML <linux-kernel@vger.kernel.org>, x86 <x86@kernel.org>,
        Ingo Molnar <mingo@kernel.org>,
        Tony Luck <tony.luck@intel.com>,
        Dave Hansen <dave.hansen@intel.com>,
        Alison Schofield <alison.schofield@intel.com>,
        Reinette Chatre <reinette.chatre@intel.com>,
        Tom Lendacky <thomas.lendacky@amd.com>,
        Stefan Talpalaru <stefantalpalaru@yahoo.com>,
        David Woodhouse <dwmw2@infradead.org>,
        "Benjamin Herrenschmidt" <benh@kernel.crashing.org>,
        Jonathan Corbet <corbet@lwn.net>,
        "Rafael J . Wysocki" <rafael@kernel.org>,
        Peter Zilstra <peterz@infradead.org>,
        Andy Lutomirski <luto@kernel.org>,
        Andrew Cooper <Andrew.Cooper3@citrix.com>,
        Boris Ostrovsky <boris.ostrovsky@oracle.com>,
        Martin Pohlack <mpohlack@amazon.de>,
        Ashok Raj <ashok.raj@intel.com>,
        "Li, Aubrey" <aubrey.li@intel.com>
Subject: Re: [Patch v3 Part2 1/9] x86/microcode: Taint kernel only if
 microcode loading was successful
Message-ID: <Y9lHDWjjnqdletL3@a4bf019067fa.jf.intel.com>
References: <20230130213955.6046-1-ashok.raj@intel.com>
 <20230130213955.6046-2-ashok.raj@intel.com>
 <Y9kAlKFfdek2rq6g@zn.tnic>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <Y9kAlKFfdek2rq6g@zn.tnic>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?VNPpq/FZ59dV9JENGFEFLIB3KVhpJFB7kfJrecp9VmDBUzC2TSt/r9Y8eNB8?=
 =?us-ascii?Q?yHa9RA01+18PuOdDxrrrgMnqKMt3kpmcFPjbsxmwsuk7VCfjAIX6UdDx8RWV?=
 =?us-ascii?Q?hTif5dtAL7u47lHgdk+/Ec1FZGDVV20k/aUKb3cnxQogWDqd/r0rbBFb2dCI?=
 =?us-ascii?Q?76GtwxwK87JbuunQjkECdaOXMECEljHTgNwAZ2YgDrrmmqvTUMvK4fJ7F1Pt?=
 =?us-ascii?Q?Klp8jaL1tGm7K4wG+rvEHskMTNEUMWN8WHU7jKyU5WPE9WfCwdL0XhuJIoir?=
 =?us-ascii?Q?pHJ8k6JUbLZIBJ9/aQRwFfMCuADAK2pperxpaObIwFb0Rpgk0wJPuWaRnFsa?=
 =?us-ascii?Q?8tHZLOrRMdUld53fsCEF6KJjwKxJqaXeVK4ZN23vTSho6sv636bYz+RBP1Yv?=
 =?us-ascii?Q?jPdN2DyfWCtsvkG1rpfG2M97nm1YYEbwTWxcZLtABVs+Q5iH1r5uH/Of/OZA?=
 =?us-ascii?Q?P5uQ65Udlv2Z5EJY17QmC5eXzgjIPHsN9g9zlxvouWmYUan3W5bLShiAD07E?=
 =?us-ascii?Q?O1uqNflbrRJO0Y+/M4c1ZejcU20ASACbjkC2odx7fl8byyVb6UF8lmz96X/P?=
 =?us-ascii?Q?lmhlXUSZpw4viUCv7fOL9OytDF2ePtkYUxuPB03jMhTniuYKdYwRzpRbNBIp?=
 =?us-ascii?Q?+7f1RvNqxkaAqcnUM23tHtDKylkzlK7dBDmsYkuOns0SozgKBVPMpUsKyY4/?=
 =?us-ascii?Q?0B/BVyva6U1mbzLGAIj+zv7oIzjvIbuBHRrTyxqGONEYFDZpOJ+rIV8e1ojg?=
 =?us-ascii?Q?G/rIDZLfbBIRb+z+9PJBcFeyPaHqcliZuJwbtYbvN59ygsK8Dz3qEadTJkMz?=
 =?us-ascii?Q?msCtn6jWnbVB91eSkaalA259D/J5PzgTjlTM/f5tYoblvJ3anl4je/7tLoeA?=
 =?us-ascii?Q?cykM9MlW+XM03QIYNjFHR7EGCVDcPK3RGe1T0VLhhWOFfbsX23Qz1shkBqAJ?=
 =?us-ascii?Q?iICSINJX88bfruJi/XQ4zUKWGhZyGvI4MHFzIjXm30MUgbg7O+td88mFuEvv?=
 =?us-ascii?Q?dxu78WLitaItkj6LJY6VpDLVz56AtuiWNBv+GZYc0UErhHRWhh3wuqiO9Opf?=
 =?us-ascii?Q?jsT1dh8PdVd09kkmKifILxE/5qXCSzJCn5GeCqmMbjz/nUcvbrZa820mObqI?=
 =?us-ascii?Q?KuA6JfVi4BaC4RGU2ZoBppjCPm2/8R34eheTWE2qRE67A7oMDQtOpTxuukpQ?=
 =?us-ascii?Q?5pe+PImqqKPHnurAYhfaRl0ycSAoRwhdtHLWbB5H+zaXkrrdJd4LgTQk9+5p?=
 =?us-ascii?Q?NRHMoMWjQB2IZxz0Zkc1iSNh5Y/cTZVnNuOKeaPX5nW86adiX5LmsRndyGZb?=
 =?us-ascii?Q?vD5xsR7V42Tra96lkpvCDTtZsvZy1zFwD50ewPtNG8S9xpTdb36xP2AaVHuL?=
 =?us-ascii?Q?1x2rk6iSyGgCcHiQaLT9S8GSLsHykD/IY3X3GdSFIWRnL7ZhW3sLTyUl8aLI?=
 =?us-ascii?Q?9Qj5rdT+AeDU/kbt9qLkOAZdyDRxgqCxnnofThTCypZSdUtjuPCwd0I+SvX0?=
 =?us-ascii?Q?g5JKi+uU0zLxRXcABfpVNj5FnJxM2WScUHi+1jqyYU1MDLNQxNuLUl/nFbcy?=
 =?us-ascii?Q?Ahq9UGH/7H/h0v9N+MReYuHNSKNOhpTYweUbFikwUbUbv+ud4gagxBfAjuXc?=
 =?us-ascii?Q?TA=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: b8167c59-c738-4cac-398c-08db03ab65c8
X-MS-Exchange-CrossTenant-AuthSource: SJ1PR11MB6201.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Jan 2023 16:51:28.8093
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: KRg3ekFbiPRe1iCY7vcXtYRBNDR0Mgxn30PSJM4yLUh0b8KpeU+d/0RJiLjBLLdImcIybS3M2AhuG2/v0TddxA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR11MB4926
X-OriginatorOrg: intel.com
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Jan 31, 2023 at 12:50:44PM +0100, Borislav Petkov wrote:
> On Mon, Jan 30, 2023 at 01:39:47PM -0800, Ashok Raj wrote:
> >  arch/x86/kernel/cpu/microcode/core.c | 19 +++++++++++++------
> >  1 file changed, 13 insertions(+), 6 deletions(-)
> 
> Why all this hoopla and unrelated changes?
> 
> Why don't you simply hoist the call to ->request_microcode_fw outside of
> the locked region as it doesn't have to be there and then do the usual
> pattern?

Makes total sense, and seems to make the code more readable. Thanks!

Just some minor changes below.

remove ret = 0 during initialization since its cleared right below. (tglx)

Some more below, updated patch at the end.

I have tested with the modified patch below.

> 
> ---
> diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
> index 14a2280fdcd2..23f4f22df581 100644
> --- a/arch/x86/kernel/cpu/microcode/core.c
> +++ b/arch/x86/kernel/cpu/microcode/core.c
> @@ -481,28 +481,28 @@ static ssize_t reload_store(struct device *dev,
>  	if (val != 1)
>  		return size;
>  
> +	tmp_ret = microcode_ops->request_microcode_fw(bsp, &microcode_pdev->dev);
> +	if (tmp_ret != UCODE_NEW)
> +		return ret;
> +
>  	cpus_read_lock();
>  
>  	ret = check_online_cpus();
>  	if (ret)
> -		goto put;
> -
> -	tmp_ret = microcode_ops->request_microcode_fw(bsp, &microcode_pdev->dev);
> -	if (tmp_ret != UCODE_NEW)
> -		goto put;
> +		goto unlock;

Need to set ret explicitly to either -EINVAL, or size. Otherwise it will be
endlessly waiting for write to complete. (As Aubrey pointed out)

>  
>  	mutex_lock(&microcode_mutex);
>  	ret = microcode_reload_late();

I think its safe to leave ret as is, since microcode_reload_late() only
returns -1, or 0.

>  	mutex_unlock(&microcode_mutex);
>  
> -put:
> -	cpus_read_unlock();
> -
>  	if (ret == 0)
>  		ret = size;
>  
>  	add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);

Pull this into the ret == 0, so taint only if the update was successful? 
And add a message so its not silent?

>  
> +unlock:
> +	cpus_read_unlock();
> +
>  	return ret;
>  }
>  
> 

diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 94d942c1bf2c..550b7c566311 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -472,7 +472,7 @@ static ssize_t reload_store(struct device *dev,
 	enum ucode_state tmp_ret = UCODE_OK;
 	int bsp = boot_cpu_data.cpu_index;
 	unsigned long val;
-	ssize_t ret = 0;
+	ssize_t ret;
 
 	ret = kstrtoul(buf, 0, &val);
 	if (ret)
@@ -483,7 +483,7 @@ static ssize_t reload_store(struct device *dev,
 
 	tmp_ret = microcode_ops->request_microcode_fw(bsp, &microcode_pdev->dev);
 	if (tmp_ret != UCODE_NEW)
-		return ret;
+		return (tmp_ret == UCODE_ERROR ? -EINVAL : size);
 
 	cpus_read_lock();
 
@@ -495,10 +495,11 @@ static ssize_t reload_store(struct device *dev,
 	ret = microcode_reload_late();
 	mutex_unlock(&microcode_mutex);
 
-	if (ret == 0)
+	if (ret == 0) {
 		ret = size;
-
-	add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
+		add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
+		pr_warn("Microcode late loading tainted the kernel\n");
+	}
 
 unlock:
 	cpus_read_unlock();